
IN THE CLAIMS: 

Please amend the claims as follows: ■ ^ — — - — - — " — — 

1 . (Currently Amended) A method of reconstructing a session using a first analyzer coupled to a 
second analyzer and a data collector, the method comprising: 

performing session reconstruction analysis on packets received at the a^first analyzer; 
responsive to successful session reconstruction on the first analyzer, sending a first message to at 
least one of the a^second analyzer separate from the first analyzer and the a_data collector, the first 
message corresponding to session data; and 

responsive to unsuccessful session reconstruction on the first analyzer, sending one or more 
messages to the second analyze r, th e s e cond analyz e r also r e c e iving on e or mor e m e ssag e s from a 
third analyz e r; 

wherein the one or more messages from the first analyzer to the second analyzer comprise 
packets received by the first analyzer which are unrecognized, and the second analyzer recognizes 
the unrecognized packets to successfully reconstruct the session. 

2. (Cancelled) 

3. (Currently Amended) The method of claim 12, wherein the one or more messages from the 
first analyzer to the second analyzer further comprise hints generated by the first analyzer. 

4. (Original) The method of claim 3, wherein hints for a packet comprise a time the packet was 
received and an address information for the packet. 

5. (Original) The method of claim 1, wherein the packets received at the first analyzer are 
output from a filter for controlling which packets in a plurality of packets flowing into the filter reach 
the first analyzer. 

6. (Currently Amended) The method of claim 1, further comprising: 

performing session reconstruction analysis on the one or more messages received at the 
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second analyzer; 

responsive to successful session reconstruction on the second analyzer, sending a first 
message to at least one of a fourth third analyzer and the data collector, the first message 
corresponding to session data; and 

responsive to unsuccessful session reconstruction on the second analyzer, sending one or 
more messages to the fourth third analyzer, the fourth third analyzer also receiving one or more 
messages from a fifth fourth analyzer. 

7. (Original) The method of claim 1, wherein the one or more messages from the first analyzer 
to the second analyzer comprise summary of packets received by the first analyzer and one or more 
hints generated by the first analyzer. 

8. (Currently Amended) The method of claim 1, further comprising performing session 
reconstruction using the second analyzer on the one or more messages received from the first 
analyzer and the one or more messages received from the athird analyzer. 

9. (Original) The method of claim 8, further comprising sending a second message from the 
second analyzer to the data collector, the second message corresponding to session data. 

10. (Currently Amended) A system for reconstructing a session, the system comprising: 

a plurality of packet sources, each of the plurality of packet sources generating a plurality of 
packets; 

a first analyz e r; 

a plurality of separate analyzers, each of the plurality of analyzers coupled to a packet source 
in the plurality of packet sources, each of the plurality of analyzers for session reconstruction on 
respective packets in the corresponding packet source, e ach of th e plurality of at least one analyzers 
sending a first message corresponding to session data for reconstructed sessions to a the first 
analyzer and a second message for unreconstructed session data in the respective packets to the first 
analyzer, 

and wherein the first analyzer responsive to receiving messages from at least one other t he 
plurality of analyzers attempts session reconstruction using the messages; 
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wherein the second message comprises packets received by one analyzer which are 
unrecognized, and the first analyzer recognizes the unrecognized packets to successfully reconstruct 
the session. 



12. (Currently Amended) The system of claim 1044 wherein the second message further 
comprises hints. 



13. (Original) The system of claim 10 wherein the second message comprises summary of 
respective packets and hints. 

14. (New) A method of reconstructing a session using a first analyzer coupled to a second 
analyzer, the method comprising: 

performing session reconstruction on packets received at a first analyzer; and 

responsive to unsuccessful session reconstruction on the first analyzer, sending one or more 

messages to a second analyzer separate from the first analyzer; 

wherein the one or more messages from the first analyzer to the second analyzer comprise 

packets received by the first analyzer which are unrecognized, and the second analyzer recognizes 

the unrecognized packets to successfully reconstruct the session. 

15. (New) The method of claim 14, wherein the one or more messages from the first analyzer to 
the second analyzer further comprise hints generated by the first analyzer. 

16. (New) The method of claim 15, wherein the hints comprise a time when at least one of the 
packets was received and address information for the packet. 

17. (New) The method of claim 14, wherein the packets received at the first analyzer are output 
from a filter for controlling which packets in a plurality of packets flowing into the filter reach the 
first analyzer. 



11. 



(Cancelled) 
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